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BACKGROUND OF THE INVENTION 
The present invention relates to a system for safety checking or transport of 
persons by an elevator installation and to a method for operating this system. 

Systems for security checking of persons are known. For example, such systems 
1 0 control the entrance/exit of persons to/from buildings, floors, rooms, etc. 

Intelligent systems for transporting persons enable transport, which is controlled 
by identification, of persons in transport means. The specification of European patent EP 
0 699 617 shows a device for controlling an elevator installation in which the elevator 
installation is controlled by a person through an identification code. In that case, a 
15 recognition device recognizes the identification code and passes it on as a control signal 
to a processing unit. This unit reads the control signal and allocates thereto a predefined, 
desired travel destination. The bearer of the identification code is thus identified and a 
travel destination is assigned to him or her. The processing unit transmits a 
corresponding control signal to the elevator installation, which then automatically 
2 0 conveys the person to the travel destination. 

It has now proved to be a disadvantage that unauthorized persons can use the 
identification code in order to gain access to buildings, floors, rooms, etc., and in order to 
be able to be transported by the elevator installation. 

According to the PCT specification WO 01/25128 a person carries a mobile input 

2 5 device w hich u ndertakes a uthentication b y s peech r ecognition a nd c hecks w hether the 

person is who he or she purports to be. The person also inputs his or her travel 
destination by way of the mobile input device, which passes on the travel destination as a 
control signal to a processing unit, which then communicates a c orresponding c ontrol 
signal to the elevator installation which automatically transports the person to the travel 

3 0 destination. The relative awkwardness of this input device, which also necessitates an 

associated electrical current supply, is disadvantageous. 
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SUMMARY OF THE INVENTION 
It is the object of the present invention to provide a system for security checking 
or transporting persons by an elevator installation and a method of operating this system, 
wherein the reliability of the identification is increased in simple mode and manner with, 
5 at the same time, a more user- friendly possibility of input of a travel destination. 

The present invention fulfils the object in that a person, who is to be transported 
by an elevator installation, is authenticated by detection of at 1 east o ne a uthentication 
signal by at least one mobile authentication device. For this purpose an authentication 
signal is detected from the person and checked with at least one person reference. If the 
1 0 authentication signal and person reference correspond, at least one identification code is 
provided. The identification code is detected by a stationary recognition device. A 
predefined travel destination or a travel destination input at the recognition device by the 
person is assigned to the identification code. 

Advantageously, the mobile authentication device is similar in size and weight to 
15 a credit card and the person carries it with them and can use it at any time simply and 
quickly. For example, a person takes an authentication device, which is similar to a card, 
with a fingerprint sensor near the elevator installation in his or her hand and an 
authentication of the person and a destination call take place already. In addition, the use 
of this authentication device by a single person is very hygienic. Advantageously, the 
2 0 mobile authentication device does not require an own energy source, but is supplied with 
electrical current by at least one external energy source, which makes this authentication 
device simple to use and maintain and economic to provide. 

A biometric signal is used as the authentication signal. Advantageously, a 
fingerprint, or a hand geometry, or a facial profile, or an iris pattern, or a retinal scan, or a 

2 5 thermogram, or a smell, or a voice, or a signature, or pressing a button is used as 

authentication signal. 

Advantageously, the stationary recognition device comprises at least one input 
means for input of the travel destination, which can be a known and proven control and 
display p anel w ith b uttons o r a t ouch s creen. This has the advantage that the mobile 

3 0 authentication device does not have to contain such input means and can be constructed 

to be correspondingly small and simple. 
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Advantageously, the identification code is checked with a user reference in order 
to establish whether the person is also a registered user of the elevator installation. In 
this identification it is checked whether at least one user reference exists for the detected 
identification code. 

5 Advantageously, in the case of successful association of identification code and 

user reference at least one control signal is transmitted to the elevator installation in order 
to transport the person to the travel destination. In the case of an unsuccessful 
authentication or in the case of an unsuccessful identification, at least one alarm signal is 
transmitted in order to lock the person in the elevator car or to deny the person access to 

1 0 the travel destination. 

Advantageously, in addition to authentication and identification there is carried 
out an access control in which it is established whether the person also has authorized 
access to the travel destination. Advantageously, an access authorization to the travel 
destination is checked with at least one access authorization. The travel destination of 

1 5 the person is advantageously compared w ith a 1 ist o f t ravel d estinations o f t he a ccess 
authorization. In the case of presence of access authorization to the travel destination, at 
least one control signal is communicated to the elevator installation in order to transport 
the person to the travel destination. In the case of unsuccessful access check, at least one 
alarm signal is communicated in order to lock the person in the elevator car or to deny 

2 0 the person access to the travel destination. 

The present invention is suitable for exclusive, as also for alternative or 
supplementary, identification of persons in elevator installations. For example, for this 
purpose m obile a uthentication d evices c arried b y p ersons a re s upplemented b y further 
stationary authentication devices near the elevator installation. Such a need exists, for 

2 5 example, in zones with high security requirements, such as banks, military zones of 

protection, etc. 

DESCRIPTION OF THE DRAWINGS 
The above, as well as other advantages of the present invention, will become 

3 0 readily apparent to those skilled in the art from the following detailed description of a 

preferred embodiment when considered in the light of the accompanying drawings in 
which: 
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Fig. 1 is a schematic part block and part flow diagram of a first embodiment of an 
apparatus and a method in accordance with the present invention; and 

Fig. 2 is a schematic part block and part flow diagram of a second embodiment of 
an apparatus and a method in accordance with the present invention. 

5 

DESCRIPTION OF THE PREFERRED EMBODIMENT 
In these basic illustrations, Figs. 1 and 2, a person P is transported by an elevator 
installation A. Authenticatable goods can also be transported instead of a person. The 
elevator installation A can be any elevator installation, which is installed inside or 
1 0 outside a building, with an elevator car, a drive and an elevator control AS. A drive with 
an elevator car fastened to a conveying cable and a counterweight fastened to the 
conveying cable are schematically illustrated. All known and proven elevator 
installations can be used. For example, hydraulic elevator installations or also such in 
which the drive is fastened directly to the car, and naturally also escalators, can be used. 
15 An a uthentication d evice F d etects a 1 1 east o ne a uthentication s ignal P 0 of the 

person P, checks the authentication signal PO and provides an identification code P 2. 
The following biometric methods of authentications are preferably used: 

Fingerprint - A fingerprint of the person P is detected, for example scanned. 
Preferably, the person P places a finger on a surface of the authentication device F, where 
2 0a fingerprint is photographed by a camera as a grey tone image. The grey tones are 
preferably converted to binary or the line widths reduced. Details are marked. 

Hand geometry - Dimensions of a hand of the person P are detected. The person 
P preferably places at least a part of his or her hand on a surface of the authentication 
device F, where a three-dimensional silhouette of the hand is photographed by a camera. 

2 5 Protrusions preferably assist in positioning the hand. 

Facial profile - A facial profile of the person P can be detected as a three- 
dimensional model or as a two-dimensional pattern or as an infrared image as well as a 
combination of these methods. In addition, black-and-white images or color images can 
be detected. The detection angle can vary, thus profile images or frontal images or 

3 0 general perspectives can be detected. In terms of time, a static image or an image 

sequence can be detected. The authentication device F photographs at least a part of the 
facial profile of the person P by a camera. 

4 

16715 



Iris profile- A texture of the iris of the person P is detected. Preferably, the 
person P stands at a spacing of a few decimeters distance in front of the authentication 
device F and looks into a camera, which camera photographs the iris texture. This 
photograph is digitized to form an iris code. The iris is preferably divided into annular 
5 regions and characteristic features are marked. 

Retinal scan - A structure of the veins of the retina of the person P is detected, for 
example scanned. The person P preferably stands at a few decimeters distance in front of 
the authentication device F and looks into a camera, which camera photographs the 
structure of the veins of the retina. For this purpose the eye is preferably irradiated with 
1 0 infrared light. The photoreceptive structures of the eye reflect the infrared light, which 
reflection is photographed. This photograph is digitized to form a retina code and 
characteristic features are marked. 

Thermogram - Thermal radiation of the person P is detected. Preferably, a 
thermal camera of the authentication device F records a facial or whole body 
15 thermogram. 

Smell - A smell of the person P is detected by a smell sensor of the authentication 
device F. 

Voice - Vocal pitch or voice break or accents or speech impediments of the 
person P is or is or are detected. For that purpose the person P speaks into a microphone 
2 0 of the authentication device F and one or more phrases are recorded. 

Signature - A signature of the person P is detected, for example scanned. The 
person P writes a signature on a surface of the authentication device F, which signature is 
photographed by a camera. Preferably, strokes or dynamics or sounds of writing of the 
signature are marked or determined. 

2 5 Pressing a button - The mode and manner how buttons of a keyboard are pressed 

by the person P are detected. Preferably, the authentication device F ascertains, by 
sensors, the force or dynamics of the pressing of the button. 

Advantageously the authentication device F comprises at least one sensor S for 
detecting the authentication signal PO, at least one data store Bl for filing a person 

3 0 reference PI, at least one data store for storing a recognition software, as well as at least 

one computer unit for execution of the recognition software. The sensor S is, for 
example, a camera for detecting a fingerprint, or a hand geometry, or a facial profile, or 
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an iris profile, or a retinal scan, or a signature. The sensor S is, for example, a thermal 
camera f or d etecting a thermogram. The sensor S is, for example, a smell sensor for 
detecting a smell. The sensor S is, for example, a microphone for detecting a voice. The 
sensor S is, for example, a button for detecting the pressing of the button. At least one of 
5 the authentication signal PO is advantageously digitized and filed in at least one 
preceding method step as the person reference PI. With the recognition software there 
takes place an authentication by comparison of the detected authentication signal PO with 
the filed person reference PI. For example, specific characteristic features of the 
authentication signal PO and the person reference PI are compared with one another. 
1 0 This is carried out by a standard software which is available to an expert in the field of 
elevators. 

The authentication signal PO is assignable more or less uniquely to the person P 
or the acceptance on the part of the user to be subjected to an authentication is high to a 
greater or lesser extent. Thus, the iris pattern can be assigned quite uniquely to a person, 
1 5 but acceptance of an iris pattern authentication is low. 

In a preferred form of embodiment at least two authentication signals PO are 
'detected from the person P and checked. Especially in high-security systems - thus in 
security-conscientious buildings such as banks, military facilities, etc. - several 
authentication signals PO are detected from the person P and evaluated. For example, a 
2 0 fingerprint and an iris pattern of the person P are detected. The uniqueness of the 
authentication is thereby strongly increased. 

Advantageously the authentication takes place b efore e ntering t he e levator c ar. 
Advantageously the authentication device F is used in the immediate vicinity of the 
elevator installation A. Advantageously the authentication device F and a recognition 

2 5 device E of the elevator installation A comprise a transmitting and receiving unit. For 

example, the authentication device F comprises a transponder which transmits or 
receives codes by radio signals. For this purpose, typical radio frequencies are 900 MHz 
to 6 GHz. For example, the authentication device F automatically receives at least one 
recognition signal from the recognition device E as soon as the receiving unit of the 

3 0 authentication device F is disposed at a spacing of a few decimeters from the transmitting 

unit of the recognition device E. With knowledge of the present invention, the expert 
can obviously also use other transmitting and receiving units and other radio frequencies. 
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The authentication device F is mobile, i.e. the person P carries it in size and 
weight similarly to a credit card and can use it at any time simply and quickly. The use 
of the authentication device F by a single person is very hygienic. In a first advantageous 
form of embodiment the authentication device F does not need an energy source, but uses 
5 an external energy source for an electrical current supply. For example, the 
authentication device F is supplied with current by way of an electromagnetic field. This 
can take place by radio waves via the recognition device E as soon as the authentication 
device F is disposed at a spacing of a few decimeters from the recognition device E. In a 
further advantageous form of embodiment the authentication device F is autonomous in 
10 terms of energy, i.e. it has an own electrical current supply like a battery, an accumulator, 
a fuel cell, etc. 

Advantageously, the authentication device F or the recognition device E 
comprises at least one output means for the output of an acoustic or optical or mechanical 
demand signal. For example, an acoustic demand signal in the form of a tone sequence is 

15 used, for example an optical demand signal in the form of a light is used, or for example 
a mechanical demand signal in the form of a vibration is used. Obviously, demand 
signals can also be combined with one another and varied. 

Advantageously the person P has a predetermined time window in order to 
undertake the authentication as well as the identification. For example, the 

2 0 authentication by the sensor S and the recognition software of the authentication device F 
lasts exactly 15 seconds. Through setting a time window of 60 seconds the person P has 
sufficient time to also actually undertake this authentication, i.e. to bring the 
authentication device F into position, to detect an authentication signal, to compare the 
detected authentication signal with the filed person reference PI and to transmit the 

2 5 result to the recognition device E. Obviously, the authentication of the person can also 

be less than 15 seconds depending on the respective sensor which is used, for example 
less than 5 seconds, for example less than 1 second. 

The result of the authentication is either positive or negative. In the case of 
positive authentication, i.e.onc orrespondence o f the authentication s ignal P 0 and the 

3 0 person reference PI, the output software provides at least one positive authentication 

signal P1+. In the case of negative authentication, i.e. in the case of non-correspondence 
of the authentication signal P0 and the person reference PI, the output software provides 
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at least one alarm signal P13. Advantageously, the identification code P2 is set up and 
filed in at least one preceding method step. For example, the identification code P2 is a 
numerical sequence or a numeral and letter sequence. 

Basically, the identification code P2 filed in the authentication device F, or the 
5 alarm signal PI 3 of the authentication device F, or the authentication code P2 known to 
the person P is transmitted. For the first case, the authentication device F 
advantageously comprises at least one second data store B2 for filing the identification 
code P 2, a 1 1 east o ne d ata s tore f or s toring an o utput s oftware a s w ell as at least one 
computing unit for executing the output software. The output software checks the 
10 presence of the positive authentication signal P1+ and thereupon provides the filed 
identification code P2. 

The transmission of the identification code P2 or of the alarm signal PI 3 to the 
recognition device E can take place in numerous ways: 

- Thus, it is possible that the authentication device F comprises a transmitting and 
15 receiving unit and communicates the identification code P2 filed in the authentication 

device F or the alarm signal PI 3 of the authentication device F by radio to the 
recognition device E. 

- For example, i t i s also p ossible that the p erson Pis provided acoustically or 
optically or mechanically with the identification code P2 or the alarm signal PI 3 from 

2 0 the authentication device F with an output means and that the person P inputs the 
identification code P2 at the input means of the recognition device E. 

- Alternatively thereto it is possible that the person P receives, from the 
authentication device F or the recognition device E with an output means, an acoustic or 
optical demand signal for entry at the recognition device E of the identification code P2 

2 5 known to the person P. 

- It is also possible that the person P receives, from the authentication device F or 
the recognition device E with an output means, an acoustic or optical demand signal for 
entry, by way of an input means of the authentication device F, of the identification code 
P2 known to the person P. 

3 0 The possibilities of transmission can take place within the time window set by the 

recognition device E. However, it is also possible that the authentication device F 
transmits to the recognition device E by radio at least one transmission signal in order to 
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inform the recognition device E about the imminent transmission or in order to set the 
recognition device E a time window for transmission of the identification code P2. 
Finally, it is possible that the authentication device F sends to the recognition device E 
the positive authentication signal P1+ or the alarm signal P13 as a transmission signal. 
5 The transmission possibilities can be combined and varied. For example, it is 

possible that the person inputs the identification code P2 by way of an input means of the 
authentication device F and the authentication device F transmits this identification code 
P2 by the transmitting and receiving unit via radio to the recognition device E. For 
example, it is possible to use acoustic and/or optical and/or mechanical input means of 

10 the authentication device F or the recognition device E. An acoustic input means is, for 
example, a microphone, an optical input means is, for example, a screen (touchscreen) 
and a mechanical input means is, for example, a keyboard. 

With knowledge of the present invention the expert can realize numerous 
variations of the authentication device F, the recognition device E or a checking device 

15 C. For example, the authentication device F can be a component of an every-day 
portable apparatus for the person, such as a mobile telephone, a wristwatch, a portable 
computer (laptop, handheld, etc.), a camera, a photographic appliance, a portable radio, a 
music reproducing appliance (MP 3 player, CD player, etc.), etc. In addition, the 
authentication device F can also be a component of several such appliances. Finally, the 

2 0 authentication device F can communicate by way of any radio networks with the 
recognition device E or also directly with the checking device C. The components of the 
authentication device F, the recognition device E and also the checking device C are 
commercially available and inexpensive. 

The recognition device E is advantageously mounted in stationary position at an 

2 5 entrance to the elevator installation A. Advantageously, the recognition device E is a 

component of a control and display panel of the elevator installation A. Advantageously, 
the control and display panel is mounted near a floor door of the elevator installation A. 
In the form of embodiment of the invention according to Fig. 1, a travel destination P3 of 
the person P is predefined and filed in at least one third data store B3 of the checking 

3 0 device C. In the form of embodiment of the invention according to Fig. 2, the person P 

inputs the travel destination P3 by way of an input means of the recognition device E. 
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The identification code P2 and/or the travel destination P3 is or are transmitted 
by the recognition device E to the checking device C. Advantageously, the recognition 
device E and the checking device C communicate with one another by cable or radio. In 
that case, the recognition device E and the checking device C can form a single system. 
5 For example, a building comprises floors (not shown) and the elevator installation A with 
three elevators (only one is shown) arranged adjacent to one another. At least one of the 
recognition device E per floor is placed near the entrances (not shown) to the elevators. 
For example, each recognition device E is an insert which is pushable into a housing (not 
shown) of a control and display panel (not shown). For example, each control and 

10 display panel has at least one bus insert (not shown). These bus inserts are connected to 
a bus system (not shown), such as an LON bus. The recognition devices E communicate 
with one another by way of the bus system. For example, the checking device C is also 
an insert and pushed into one of the control and display panels. In addition, the checking 
device E communicates by way of the bus system with the recognition devices E. 

15 The checking device C checks the association with at least one filed user 

reference P4 with the identification code P2 of the person P and checks the presence of at 
least one filed access authorization P5 to the travel destination P3 of the person P. For 
that purpose it comprises at least one fourth data store B4 for filing the at least one user 
reference P4, at least one fifth data store B5 for filing at least one access authorization 

2 0 P5, at least one data store for storing a checking software and at least one computer unit 
for e xecuting t he c hecking s oftware. T he c hecking d evice C c an b e a central remote 
server. The user reference P4 or the access authorization P5 is set up and filed in at least 
one preceding method step. For example, the user reference P4 is a numerical sequence 
or a numerical and letter sequence. For example, the access authorization P5 consists of 

2 5 a list with travel destinations for which the person P is authorized with respect to access. 

The checking software checks whether the user reference P4 is filed for the 
detected identification code P2. For example, specific characteristic features of the 
identification code P2 and the user reference P4 are associated with one another. This is 
carried out by standard software which is available to an expert in the field of elevators. 

3 0 The result of the identification is either positive or negative. In the case of 

positive identification, i.e. in the case of association of the identification code P2 and the 
user reference P4, the checking device C provides at least one positive identification 
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signal P4+. In the case of negative identification, i.e. in the case of non-association of 
the identification code P2 and the user reference P4, the checking software provides at 
least one alarm signal PI 3. 

The forms of embodiment, by way of example, of the present invention according 
5 to Figs. 1 and 2 differ from one another insofar as in the first embodiment of the present 
invention according to Fig. 1, in the case of presence of the positive identification signal 
P4+, the predefined travel destination P3 is provided in the checking device C, whereas 
in the second embodiment of the present invention according to Fig. 2, the travel 
destination P3 is provided at the recognition device E. For example, the monitoring 
10 software checks the presence of the positive identification signal P4+ and thereupon 
provides the filed, predefined travel destination. 

The checking software now checks whether the person P is authorized to be 
transported to the travel destination P3 or to gain access to the travel destination P3. For 
example, the checking software carries out a comparison whether the travel destination 
15 P3 is listed on the list of travel destinations of the access authorization P5. This is 
carried out by a standard software which is available to an expert in the field of elevators. 

In the case of positive checking of the access authorization B5, the checking 
device C transmits the at least one control signal P6 to the elevator control AS of the 
elevator installation A in order to transport the person P to the travel destination P3. In 
2 0 the case of negative checking of the access authorization, the checking device C 
transmits the at least one alarm signal P13. 

In the case of presence of the alarm signal PI 3, different procedures can be 
carried out. For example, none of the floor doors to the elevator installation A is opened 
for the person P. I ndependently t hereof, a s ecurity s ervice c an b e w arned. 1 1 i s a lso 

2 5 possible to give the person P access to an elevator car and then, for example, to close the 

elevator d oor and k eep i 1 1 ocked u ntil t he s ecurity s ervice i s o n site and undertakes a 
further checking of the access authorization B5 of the person P. For example, the 
elevator car is temporarily stopped or moved to a secure and discrete floor, for example a 
basement floor, where the person P is received by the security service. With knowledge 

3 0 of the present invention, the expert has numerous possibilities of variation. For example, 

the elevator control AS in the case of the presence of the alarm signal PI 3 can grant the 
person P access to an elevator car, close the elevator door, move the elevator car to a 
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secure, discrete floor and then simulate an elevator breakdown so that the person P does 
not have any suspicion until the security service is on site for further checking of the 
access authorization B5 of the person P. 

In accordance with the provisions of the patent statutes, the present invention has 
5 been described in what is considered to represent its preferred embodiment. However, it 
should be noted that the invention can be practiced otherwise than as specifically 
illustrated and described without departing from its spirit or scope. 



12 



16715 



